Policy Condition for federated users

Question

hi all, trying to understand how to write a resource policy where I want to DENY every user identity access unless that user identity has a permission set attached to it. So far I've got this but I am certain I've got the thinking wrong. Because if I run it then ${AWS:UserId} will be replaced by the identity of the account that is deploying the resource.

In a SSO setup, I've created few groups with users in those groups. The groups have permissions attached to them. I want the users belonging to a specific group have the correct permissions when they login using SSO and assume role. Uses from other groups should get a DENY.

Open to suggestions and help. Thanks in advance.

```
"Condition": {
                "ArnNotEquals": {
                    "aws:Principal": "arn:aws:sts::${AWS::AccountId}:federated-user/${AWS:UserId}"
                }
            }
```

Answer

Hi,

I understand that you want to write a resource policy to give least privilege policy to federated users.

Creating IAM Policies that grant least privilege is one of the best security practices[1] to create IAM role refer[2]. You can view the condition operators for Amazon Resource Name (ARN) on attached document[3]. The condition operator that you can use in a policy depends on the condition key you choose.

Please see the attached document [4] for reference identifiers.

I hope this helps

Resources:-

[1] https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#grant-least-privilege

[2] https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create.html

[3] https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html

[4] https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html

Policy Condition for federated users

Relevant content